DEVOURED
Trading a Cloud Identity for Your Own: Workload Attestation on Managed Compute
Netflix secured Apache Spark workloads on Amazon EMR by mapping internal identities to AWS IAM roles using a custom workload attestation service.
What: Netflix engineers created a system where a control plane signs metadata, which is then verified against cloud proofs of possession to grant workloads temporary certificates from the internal PKI, Metatron.
Why it matters: This approach decouples identity from infrastructure, allowing Netflix to manage granular permissions across managed compute environments like EMR without relying on static AWS credentials.
Decoder
- Workload Attestation: A security process where a service proves its identity and runtime environment characteristics to a verifier.
- PKI (Public Key Infrastructure): A set of roles, policies, and procedures needed to create, manage, distribute, and revoke digital certificates.
Original article
Netflix engineers developed a method to bridge AWS IAM roles with internal identities for Apache Spark workloads on Amazon EMR. The system maps each Data Project identity to a dedicated IAM role, allowing a control plane to sign metadata that an identity service verifies against a cloud proof of possession. This approach ensures that workloads running on managed compute obtain valid certificates from the internal PKI, called Metatron, without relying on the workload's own account of itself.
Explore all 67 articles in today's digest
Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi